TWI545923B - Network device, ipsec system and method for establishing ipsec tunnel using the same - Google Patents

Description

Network devices, use their Internet Protocol security systems, and establish an Internet Method of road agreement security channel

The present invention relates to a network device, and more particularly to a network device security network device, an internet protocol security system using the same, and a method for establishing an internet protocol security channel.

With the development of the Internet and the popularity of mobile communications, the security requirements for data transmission in the network are also increasing. Therefore, it is increasingly important to transmit data using Internet Protocol security (IPsec) transmission. How to effectively reduce the hardware cost in the IPsec transmission mode and to facilitate the use of the general user is one of the current topics in the industry.

The invention relates to a network device and an internetwork using the same A protocol security system and a method of establishing an internet protocol security channel.

According to a first aspect of the present invention, a network device is provided for connecting a plurality of slave network devices. Each slave network device communicates with the network device using an Internet Protocol (IP) address, and the network device includes Internet Protocol Security (IPsec) module and network address translation ( Network Address Translation, NAT) module. The IPsec module is used to establish an IPsec channel to a network gateway in the Internet and obtain an IPsec IP address corresponding to one of the IPsec channels. The NAT module is used to convert the IP addresses of the slave network devices to the IPsec IP address, so that when the slave network devices establish an IPsec channel to connect to the network gateway through the IPsec module, the slave network devices This IPsec IP address is connected to the network gateway.

In accordance with another aspect of the present invention, an Internet Protocol Security System is provided that includes a network gateway and a network device. The network gateway is used to connect to an intranet, and the internal network is connected to the Internet through a network gateway. The network device is configured to connect to multiple slave network devices, and each slave network device communicates with the network device by using an IP address, and the network device includes an IPsec module and a NAT module. The IPsec module is used to establish an IPsec channel to the network gateway in the Internet and obtain an IPsec IP address corresponding to one of the IPsec channels. The NAT module is used to convert the IP addresses of the slave network devices to the IPsec IP address, so that when the slave network devices establish an IPsec channel to connect to the network gateway through the IPsec module, the slave network devices This IPsec IP address is connected to the network gateway.

According to another aspect of the present invention, an Internet Protocol Association is proposed The method for determining a security channel includes: establishing an IPsec channel from a network device to a network gateway, and obtaining an IPsec IP address corresponding to one of the IPsec channels, wherein the network device is configured to connect the plurality of slave network devices Each slave network device communicates with the network device using an IP address; and converts the IP addresses of the slave network devices to the IPsec IP address, such that when the slave network devices establish an IPsec channel through the network device When connected to a network gateway, these slave network devices connect to the network gateway with this IPsec IP address.

In order to better understand the above and other aspects of the present invention, the preferred embodiments are described below, and in conjunction with the drawings, the detailed description is as follows:

10‧‧‧Network devices

12‧‧‧Internet gateway

14‧‧‧Internet

16‧‧‧IPsec channel

18‧‧‧Internal network

102‧‧‧IPsec module

104‧‧‧NAT module

106, 122‧‧‧Encryption unit

108, 124‧‧‧Decryption unit

112~114‧‧‧Subordinate network devices

180‧‧‧Remote host

202, 204, 206, 208, 212, 214, 216, 218‧‧‧ packets

FIG. 1 is a schematic diagram of a network device security system and a network protocol security system to which it is applied according to an embodiment of the invention.

Figure 2 is a schematic diagram showing the network device transmitting a packet to the Internet.

Figure 3 is a schematic diagram showing the network gateway receiving packets from the Internet.

Figure 4 shows a schematic diagram of a network gateway transmitting a packet to the Internet.

Figure 5 is a schematic diagram showing the network device receiving a packet from the Internet.

FIG. 1 is a schematic diagram of a network device security system and a network protocol security system to which it is applied according to an embodiment of the invention. The network device 10 is connected to a plurality of slave network devices 112-114, and each of the slave network devices 112-114 uses the Internet. The Internet Protocol (IP) address communicates with the network device 10. The network device 10 includes an Internet Protocol Security (IPsec) module 102 and a Network Address Translation (NAT) module 104. The IPsec module 102 is configured to establish an IPsec tunnel 16 to a network gateway 12 in the Internet 14, and obtain an IPsec IP address corresponding to one of the IPsec tunnels 16. The NAT module 104 is configured to convert the IP addresses of the slave network devices 112-114 to this IPsec IP address, such that the slave network devices 112-114 are connected to the network gateway 12 via the IPsec channel 16 with the IPsec IP address. .

The "connection" described herein may be a direct or indirect connection, or a wired connection or a wireless connection. For example, the network device 10 and the slave network devices 112-114 can be connected through a cable or through a wireless network, and are not limited. The three slave network devices are shown in FIG. 1 as an illustrative example. The number of slave network devices that can be actually used may be more than three or less than three, and is not limited.

The network device 10 is, for example, a cellular base station, a router, or a wireless network access point (wireless AP). The slave network devices 112-114 are, for example, cellular base stations, routers, wireless network access points, computer hosts, or mobile devices. Each of the slave network devices 112-114 may be different or the same. For example, in a general user home environment, the network device 10 may be a small honeycomb cell such as a femtocell, and the network device 10 is connected. The slave network device 112 can be a router, and the slave network device 113 can be a wireless network access point, a slave network device 114 can be the user's mobile phone.

The slave network devices 112-114 and the network device 10 may form part of a regional network, and each of the slave network devices 112-114 has a different private IP address, for example, 192.168.0.0~192.168.255.255 The IP address of the segment, and the network device 10 also has a private IP address. In FIG. 1, the private IP addresses of the slave network devices 112-114 are, for example, 192.168.1.2 to 192.168.1.4, respectively, and the private IP address of the network device 10 is, for example, 192.168.1.1. In this local area network, the slave network devices 112-114 and the network device 10 communicate with each other with a private IP address. The slave network devices 112-114 are connected to the Internet 14 via the network device 10, and the network device 10 has a public IP address in the Internet 14, that is, a real IP address. The real IP address of the network device 10 is, for example, 200.0.0.3.

The network gateway 12 is connected to an internal network 18 which is connected to the Internet 14 via a network gateway 12. The internal network 18 can be a regional network within an enterprise or a core network of a carrier. For example, in a 4G Long Term Evolution (LTE) wireless communication system, the internal network 18 may be an Evolved Packet Core (EPC), and the network gateway 12 controls the external Internet 14 The packet transmission to be connected to the internal network 18. The network gateway 12 is, for example, a security gateway.

When the slave network device 112 wants to establish a secure connection to the remote host 180 in the internal network 18, the IPsec tunnel mode in the IPsec protocol is used to establish a secure connection. The slave network device 112 needs to pass through the network. The way device 10 is connected to the Internet 14, and the connection from the Internet 14 to the internal network 18 must pass through the network gateway 12. The IPsec module 102 in the network device 10 establishes the IPsec channel 16 to the network gateway 12 using the IPsec tunnel mode, while the NAT module 104 in the network device 10 converts the IP address of the slave network device 112. The detailed operation of the system is described below.

Please also refer to FIG. 2, which shows a schematic diagram of the network device transmitting the packet to the Internet. When the slave network device 112 wants to transmit data to the remote host 180 under the IPsec protocol, the slave network device 112 transmits a packet 202 to the network device 10, the packet 202 records the target IPsec IP address field DI, and the source private. IP address field SP. The range used by the IPsec IP address is the range reserved for the private IP address in the IP specification. In this exemplary embodiment, the IPsec IP address uses, for example, the IP bit of the 10.0.0.0~10.255.255.255 segment. site. The destination remote host 180 to be connected has its IPsec IP address, for example, 10.0.0.2, and the requesting slave network device 112 has a private IP address of, for example, 192.168.1.2, so the target IPsec IP address field in the packet 202. DI records 10.0.0.2, the source private IP address field SP records 192.168.1.2, and the slave network device 112 transmits the packet 202 to the network device 10.

After the network device 10 receives the packet 202, the NAT module 104 converts the private IP address of the slave network device 112 into an IPsec IP address used by the network device 10, with respect to the IPsec IP address of the network device 10. The manner of obtaining is described below.

When the IPsec module 102 in the network device 10 is connected to the Internet When a request to establish an IPsec tunnel 16 is made to the network gateway 12, the network gateway 12 issues a certificate for authentication, and after the verification succeeds, an IPsec IP address is assigned to the network device 10. Thus, the IPsec module 102 establishes an IPsec tunnel 16 to the network gateway 12 in the Internet 14, and obtains an IPsec IP address corresponding to the IPsec tunnel 16. In this exemplary embodiment, the IPsec IP address obtained by the IPsec module 102 is, for example, 10.0.0.3.

The NAT module 104 converts the field SP in the packet 202, that is, the private IP address 192.168.1.2 of the slave network device 112, and converts it into the IPsec IP address of the network device 10, 10.0.0.3, which is recorded in the packet 204. The source IPsec IP address field SI, the NAT module 104 transmits the packet 204 to the IPsec module 102.

The NAT module 104 converts the private IP address of the slave network devices 112-114 to the IPsec IP address of the network device 10 and the private IP address of the slave network devices 112-114 to the network device 10 ( The correspondence between ports is recorded in a NAT lookup table, an example of which is shown in Table 1 below.

The NAT module 104 will come from the slave network device 112 (private IP address: 192.168.1.2), the slave network device 113 (private IP address: 192.168.1.3) And the slave network device 114 (private IP address: 192.168.1.4) is converted to the same IPsec IP address 10.0.0.3, that is, different slave network devices 112-114 use the same IPsec IP address. It is connected to the network gateway 12 through the same IPsec channel 16. On the other hand, the different slave network devices 112-114 will correspond to different network devices 10, such that when the network device 10 receives packets from the network gateway 12 via the Internet 14, It is possible to know from the embarrassing information which subordinate network device the packet is to be forwarded to.

After receiving the packet 204, the IPsec module 102 can encrypt the entire packet 204. The IPsec module 102 includes an encryption unit 106 and a decryption 108. When the network device 10 transmits the packet generated by the slave network device 112 to the Internet 14, the encryption unit 106 can perform an encryption operation on the packet 204 and add an Encapsulating Security Payload (ESP) table to the packet 204. Header, as shown in packet 206 in Figure 2, the slashed portion is the encrypted field, including the ESP header field ESP, the destination IPsec IP address field DI, the source IPsec IP address field SI, and the data ( Data) field DATA. The IPsec module 102 then adds the real IP address field SG of the source host to the outermost layer and the real IP address field DG of the target host. In this embodiment, the real IP address of the network device 10 is 200.0.0.3, and the real IP address of the network gateway 12 is 200.0.0.2. The packet 206 is the packet transmitted on the Internet 14, wherein the slash portion is an encrypted field, so even if the packet 206 transmitted in the Internet 14 is eavesdropped, the eavesdropper can only know the column. Bit DG and SG information, and can not know the contents of the encrypted part of the field, but can achieve security The function of full connection.

Please refer to FIG. 3 next, and FIG. 3 is a schematic diagram showing the network gateway receiving packets from the Internet. The network gateway 12 includes an encryption unit 122 and a decryption unit 124. After the network gateway 12 receives the packet 206 from the Internet 14, the decryption unit 124 decrypts the contents of the packet 206 to obtain a packet 208 in which the source IPsec IP address (field SI) and the target IPsec IP bit are recorded. Address (field DI). Based on the content 10.0.0.2 of the field DI, the network gateway 12 can know to transmit the packet 208 to the remote host 180 in the internal network 18 (its IPsec IP address is 10.0.0.2).

2, 3, and the above illustrates the process of transmitting data from the slave network device 112 to the remote host 180. The following description of the contents of the fourth and fifth figures illustrates the transfer of data from the remote host 180 to The process of slave network device 112.

Figure 4 shows a schematic diagram of a network gateway transmitting a packet to the Internet. The packet 212 transmitted by the remote host 180 includes the target IPsec IP address field DI (recording the target IPsec IP address 10.0.0.3) and the source IPsec IP address field SI (the source IPsec IP address is recorded 10.0. 0.2) After the network gateway 12 receives the packet 212, the encryption unit 122 encrypts the packet 212, adds the ESP header, and then adds the source host real IP address field SG to the outermost layer (the source is recorded) The host real IP address 200.0.0.2) and the target host real IP address field DG (recording the target host real IP address 200.0.0.3) to form a packet 214 for transmission to the Internet 14. The field of the slash portion of the packet 214 indicates that it has been encrypted.

Figure 5 is a schematic diagram showing the network device receiving a packet from the Internet. After the network device 10 receives the packet 214 from the Internet 14, the decryption unit 108 in the IPsec module 102 decrypts the content of the packet 214 to obtain a packet 216 having the source IPsec IP address field SI (documented Source IPsec IP address 10.0.0.2) and destination IPsec IP address field DI (recorded IPsec IP address 10.0.0.3). At this time, the NAT module 104 will consult the internal NAT lookup table (as shown in Table 1), and according to the packet 214 or the packet 216 specified by the packet (for example, port 90), it is found that the packet is to be forwarded to the private IP. The address is 192.168.1.2. The NAT module 104 translates the IPsec IP address 10.0.0.3 of the field DI to the private IP address 192.168.1.2 of the slave network device 112, and the NAT module 104 generates a packet 218 correspondingly. The packet 218 has a source IPsec IP address field SI (documenting the source IPsec IP address 10.0.0.2) and a target private IP address field DP (recording the target private IP address 192.168.1.2). The NAT module 104 transmits the packet 218 to the slave network device 112. This completes the process of transferring data from the remote host 180 to the slave network device 112.

The network device and the IPsec system described in the foregoing embodiments convert the IP addresses of different slave network devices to the same IPsec IP address via the NAT module. Therefore, multiple slave network devices, such as wireless network access points, routers, and cellular base stations, can share an IPsec channel and connect to the remote network gateway using the same IPsec IP address. In this way, even if multiple slave network devices want to transmit data in IPsec mode, only one IPsec channel needs to be established, which can effectively reduce the storage capacity and computing power required by the network device responsible for IPsec. force. And the network gateway only needs to issue a certificate once, which can effectively reduce the number of documents required for the network gateway. Compared with the conventional method, it has the advantage of reducing the cost.

In addition, in the architecture described in the foregoing embodiment, only the network device needs to have related functions for processing the IPsec transmission mode, including the authentication and encryption/decryption computing capabilities required in the IPsec transmission process, and the slave network device may not need to It has the computing power associated with the IPsec function, especially the encryption/decryption operation requires more complicated circuits and consumes more power. Therefore, not only the cost of the slave network device is reduced, but also for this reason, the general user has good scalability in use. For example, a router that does not have an IPsec function, or a general smart phone, can enter the same local area network as the network device and the original slave network device, that is, the network device can The IPsec method transmits data and is easily expanded on the user side to add a slave network device.

In conclusion, the present invention has been disclosed in the above preferred embodiments, and is not intended to limit the present invention. A person skilled in the art can make various changes and modifications without departing from the spirit and scope of the invention. Therefore, the scope of the invention is defined by the scope of the appended claims.

10‧‧‧Network devices

12‧‧‧Internet gateway

14‧‧‧Internet

16‧‧‧IPsec channel

18‧‧‧Internal network

102‧‧‧IPsec module

104‧‧‧NAT module

112~114‧‧‧Subordinate network devices

180‧‧‧Remote host

Claims (17)

A network device for connecting to a plurality of slave network devices, each of the slave network devices communicating with the network device using a different Internet Protocol (IP) address, the network The device includes: an Internet Protocol Security (IPsec) module for establishing an IPsec channel to a network gateway in the Internet, and obtaining an IPsec IP bit corresponding to one of the IPsec channels. And a network address translation (NAT) module for converting the different IP addresses of the slave network devices to the same IPsec IP address, so that the slave networks The device shares the IPsec channel and connects to the network gateway through the IPsec channel using the same IPsec IP address. The network device of claim 1, wherein the network device is a cellular base station, a router, or a wireless network access point, and each of the slave network devices is a cellular base station, a router, and a wireless device. A network access point, computer host or mobile device that is a security gateway. The network device of claim 1, wherein the IPsec module includes an encryption unit and a decryption unit, and the encryption unit is configured to encrypt a packet transmitted to the network gateway through the IPsec module. The decryption unit is configured to decrypt an encrypted packet received from the network gateway. The network device of claim 1, wherein the slave network devices communicate with the network device with different private IP addresses, and the NAT module converts different private IPs of the slave network devices. The address is the same IPsec IP address, and the NAT module records the correspondence between the different private IP addresses of the slave network devices and the network device's UI in a NAT lookup table. The network device of claim 1, wherein the slave network devices communicate with the network device with different private IP addresses, and the NAT module converts the same IPsec IP address to the The slave network device records different private IP addresses, and the NAT module records the correspondence between the different private IP addresses of the slave network devices and the network device's UI in a NAT lookup table. The network device of claim 1, wherein the IPsec module uses an IPsec channel mode to establish the IPsec channel to the network gateway in the Internet. An internet protocol security system includes: a network gateway for connecting to an internal network, the internal network is connected to the Internet through the network gateway; and a network device To connect to a plurality of slave network devices, each of the slave network devices communicates with the network device using a different IP address, the network device comprising: An internet protocol security module for establishing an IPsec channel to the network gateway in the Internet, and obtaining an IPsec IP address corresponding to one of the IPsec channels; and a network address translation mode a group, configured to convert the different IP addresses of the slave network devices to the same IPsec IP address, so that the slave network devices share the IPsec channel and use the same IPsec IP address to pass the IPsec The channel is connected to the network gateway. The Internet Protocol security system according to claim 7, wherein the network device is a cellular base station, a router or a wireless network access point, and each of the slave network devices is a cellular base station. , router, wireless network access point, computer host or mobile device, the network gateway is a security gateway. The Internet Protocol security system of claim 7, wherein the IPsec module includes an encryption unit and a decryption unit, and the encryption unit is configured to encrypt the transmission to the network gateway through the IPsec module. A packet, the decryption unit is configured to decrypt an encrypted packet received from the network gateway. The Internet Protocol security system of claim 7, wherein the slave network devices communicate with the network device with different private IP addresses, and the NAT module converts the slave network devices. Different private IP addresses are the same IPsec IP address, the NAT module will be different from the slave network devices. The correspondence between the IP address and the UI of the network device is recorded in a NAT lookup table. The Internet Protocol security system of claim 7, wherein the slave network devices communicate with the network device with different private IP addresses, and the NAT module converts the same IPsec IP bit. The address is a different private IP address of the slave network devices, and the NAT module records the correspondence between the different private IP addresses of the slave network devices and the network device's UI to a NAT lookup. In the table. The Internet Protocol Security System of claim 7, wherein the network gateway comprises an encryption unit and a decryption unit, and the encryption unit is configured to encrypt and transmit to the network through the network gateway. A packet of the device, the decryption unit is configured to decrypt an encrypted packet received from the network device. The Internet Protocol security system of claim 7, wherein the IPsec module uses an IPsec tunnel mode to establish the IPsec tunnel to the network gateway in the Internet. A method for establishing an internet protocol security channel includes: establishing an IPsec channel from a network device to a network gateway, and obtaining an IPsec IP address corresponding to one of the IPsec channels, the network device is configured to connect To multiple a slave network device, each of the slave network devices communicating with the network device using a different IP address; and converting the different IP addresses of the slave network devices to the same IPsec IP address The slave network devices share the IPsec channel and connect to the network gateway through the IPsec channel using the same IPsec IP address. The method for establishing an internet protocol security channel according to claim 14, wherein in the step of establishing the IPsec channel from the network device to the network gateway, the IPsec channel mode is used to The network device establishes the IPsec channel to the network gateway. The method for establishing an internet protocol security channel according to claim 14, wherein the step of converting the different IP addresses of the slave network devices to the same IPsec IP address is The NAT method is used to convert the different IP addresses of the slave network devices to the same IPsec IP address. The method for establishing an internet protocol security channel according to claim 16, wherein in the NAT method, different private IP addresses of the slave network devices are converted to the same IPsec IP address. And mapping the correspondence between the different private IP addresses of the slave network devices and the network device to the NAT lookup table.